Fix: Expect at least one role returned from API client for user

src/Security/BpnAuthenticator.php

@@ -59,10 +59,17 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
                     return null;
                 }
 
+                // Finale checks and local user loading/creation
+                $user = $this->getOrCreateLocalUser($response, $email, $password);
+
+                if (null === $user) {
+                    return null;
+                }
+
                 // Store BPN password in session for later use
                 $request->getSession()->set('bpn_password', $password);
 
-                return $this->getOrCreateLocalUser($response, $email, $password);
+                return $user;
             }),
             [new CsrfTokenBadge('authenticate', $csrfToken)]
         );
@@ -91,7 +98,7 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
 
     private function getOrCreateLocalUser(ProfileResponse $profileResponse, string $email, string $password): ?User
     {
-        // Fetch CRM attributes, early return in case of an API arror
+        // Fetch CRM attributes, early return in case of an API error
         try {
             /** @var CrmAttributesResponse $crmAttributes */
             $crmAttributes = $this->apiClient->getCrmAttributes($email, $password);
@@ -105,6 +112,11 @@ class BpnAuthenticator extends AbstractLoginFormAuthenticator implements Authent
             ->collectRoles($crmAttributes)
         ;
 
+        // User is expected to have at least one role
+        if (0 === count($roles)) {
+            return null;
+        }
+
         // Determine teamer status from CRM attributes
         $isTeamer = $crmAttributes->isTeamer();